Logging the foreground process as it changes

Today's Little Program simply logs all changes to the foreground
window by recording the path to the application the user switched to.
You might use this as part of a usability study to monitor what
applications users spend most of their time in.

Most of this code is just taking things we already know and snapping
them together.

The main program installs an accessibility hook for the
EVENT_SYSTEM_FOREGROUND event,
and each time the event fires,
it extracts the process name and logs it to
the screen.
Since the notification is asynchronous, the foreground window
may have been destroyed by the time the notification is received,
so we have to be prepared for that case.

Neil, GPIFN gives you the path in "native" format (e.g., "DeviceHarddisk0Partition1WindowsSystem32Ctype.nls") while QPFIN gives you the option of getting the path in Windows format (e.g., "c:windowssystem32ctype.nls").

@Nitpicker: Go back and read the documentation. I used MSDN's terms. For QPFIM, a value of 1 in dwFlags means "The name should use the native system path format"; a 0 means "The name should use the Win32 path format."

@Nitpicker: Your opinion does not trump the documentation, no matter how many smileys you put in your posts. If Microsoft wants to name the underlying kernel format "native" and the Win32 format "Win32", its up to them, not you. Historical names don't matter either, otherwise we would all be using ridiculously old names for everything.